CVE-2013-5973
Summary
| CVE | CVE-2013-5973 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-12-23 15:42:00 UTC |
| Updated | 2018-10-09 19:34:00 UTC |
| Description | VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator role for a vCenter Server Add Existing Disk action with a (1) -flat, (2) -rdm, or (3) -rdmp filename. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Vmware | Esx | 4.0 | All | All | All |
| Operating System | Vmware | Esx | 4.1 | All | All | All |
| Operating System | Vmware | Esx | 4.0 | All | All | All |
| Operating System | Vmware | Esx | 4.1 | All | All | All |
| Operating System | Vmware | Esxi | 5.1 | 1 | All | All |
| Operating System | Vmware | Esxi | 5.5 | All | All | All |
| Operating System | Vmware | Esxi | 5.1 | 1 | All | All |
| Operating System | Vmware | Esxi | 5.5 | All | All | All |
| Operating System | Vmware | Esxi | 4.0 | All | All | All |
| Operating System | Vmware | Esxi | 4.0 | 1 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 2 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 3 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 4 | All | All |
| Operating System | Vmware | Esxi | 4.1 | All | All | All |
| Operating System | Vmware | Esxi | 4.1 | 1 | All | All |
| Operating System | Vmware | Esxi | 4.1 | 2 | All | All |
| Operating System | Vmware | Esxi | 5.0 | All | All | All |
| Operating System | Vmware | Esxi | 5.0 | 1 | All | All |
| Operating System | Vmware | Esxi | 5.0 | 2 | All | All |
| Operating System | Vmware | Esxi | 5.1 | All | All | All |
| Operating System | Vmware | Esxi | 4.0 | All | All | All |
| Operating System | Vmware | Esxi | 4.0 | 1 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 2 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 3 | All | All |
| Operating System | Vmware | Esxi | 4.0 | 4 | All | All |
| Operating System | Vmware | Esxi | 4.1 | All | All | All |
| Operating System | Vmware | Esxi | 4.1 | 1 | All | All |
| Operating System | Vmware | Esxi | 4.1 | 2 | All | All |
| Operating System | Vmware | Esxi | 5.0 | All | All | All |
| Operating System | Vmware | Esxi | 5.0 | 1 | All | All |
| Operating System | Vmware | Esxi | 5.0 | 2 | All | All |
| Operating System | Vmware | Esxi | 5.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| JVN#13154935: VMware ESX and ESXi may allow access to arbitrary files | JVN | jvn.jp | |
| VMware ESX and ESXi Virtual Machine File Descriptors Local Privilege Escalation Vulnerability | BID | www.securityfocus.com | |
| JVNDB-2013-000123 - JVN iPedia | JVNDB | jvndb.jvn.jp | |
| VMSA-2013-0016 | United States | CONFIRM | www.vmware.com | Vendor Advisory |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| VMware ESX Server Lets Local Users View and Modify Files - SecurityTracker | SECTRACK | www.securitytracker.com | |
| 101387 | OSVDB | osvdb.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.